T08 · Insecure Dependencies
Warning
- Location
SKILL.md:5- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawdBites
Security checks for vulnerabilities and agentic risk
Overview
The skill is aimed at recipe extraction, but it needs review because it automatically downloads and analyzes reel media, installs an unpinned Python tool, and uses unsafe shared temporary files.
Install only if you are comfortable with the agent downloading public Instagram reels, transcribing audio locally, and sending extracted frames to the active vision model when captions are incomplete. Prefer a revised version that asks before audio/video analysis, uses pinned or isolated dependencies, and stores temporary media in a private per-run directory that is cleaned up afterward.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:34- Finding
Predictable Shared Temporary Files Allow Collisions and File Clobbering
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README claims the skill can perform audio transcription, frame analysis, and smart inference, which materially expands the apparent behavior beyond the stated caption-extraction scope. Scope mismatch is dangerous because reviewers and users may grant the skill trust or permissions appropriate for a simple parser while it actually implies broader media acquisition and analysis behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Advertising a wishlist capability inside a recipe-extraction skill suggests stateful data handling and cross-skill interactions that are not justified by the core purpose. Even if benign, unexplained data retention or integration features can expand attack surface and create confusion about what user data is stored or shared.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documented workflow says the skill automatically escalates from caption parsing to audio transcription and then video frame analysis. That hidden fallback chain increases processing scope and risk, especially because it implies downloading and inspecting external media content without clearly surfacing that expanded behavior in the skill's declared purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a caption-extraction skill, but the body expands behavior to downloading reels, transcribing audio, and analyzing frames with a vision model. This scope mismatch can defeat user and platform expectations about what content will be processed, reducing informed consent and making review or policy enforcement harder.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill mandates automatic video download, audio extraction, and transcription without a user-facing warning or consent step. Even for public reels, this is a meaningful expansion of processing that may surprise users and can capture spoken content they did not intend to have transcribed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill includes writing recipe data to local storage but does not clearly warn users that data may be persisted to disk. Silent persistence can create privacy and retention issues, especially when storing source URLs, creator identifiers, dates, and user preference data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Frame-based vision analysis materially expands the capability from caption parsing to full visual inspection of video content, which is not justified by the manifest's stated purpose. This broader access can expose additional on-screen personal or sensitive information and creates unnecessary collection beyond the minimum needed for the task.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README describes automatic processing of Instagram reels, including implied downloading and analysis of external media, without warning users about that behavior. This matters because external media handling can trigger network access, large downloads, unexpected local tool execution, and privacy or policy concerns that users may not anticipate from a recipe-extraction skill.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The integration section describes saving recipes, planner suggestions, and tracking tried recipes. Those are downstream organizational features not necessary to extract a recipe from a reel caption, making them unjustified given the manifest's narrow extraction purpose.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill documents optional persistence to local files and cross-skill handoffs, but that behavior is not reflected in the manifest. Hidden storage and data-sharing behavior increases the chance that recipe URLs, creator handles, or user preferences are retained or propagated without clear user awareness.
- Content
Static analysis
No suspicious patterns detected.